Office of the Commissariat 




I am writing in response to the complaint you filed with the Privacy Commissioner 
of Canada regarding the loss of unprotected electronic files stored on an electronic 
storage device (USB) containing information from Human Resources and Skills 
Development Canada (HRSDC). 

J wish to advise you that it has come to our attention that an employee from the 
Department of Justice Canada may also have been involved in the incident which 
resulted in the ioss of the USB device. On January 28, 2013, the Privacy Commissioner 
initiated a complaint against Justice Canada in relation to the loss of the information 
stored on the USB device. 

Our Office is therefore investigating both HRSDC and Justice Canada regarding 
this incident. 

We note that your complaint is solely against HRSDC. In order to ensure that you 
are given a meaningful opportunity to make representations to our Office in relation to 
this incident, we would like to amend your complaint to include both HRSDC and 
Justice Canada as respondents. Our Office will then be able to receive from you 
information or comments which you feel are relevant to HRSDC's involvement and 
Justice Canada's involvement in this incident 



If vou consent to the amendment of your complaint to include both HRSDC and Justice 
Canada as respondents, no action is required on your part . 

Piease note that limited personal information, such as your name, may be shared with 
HRSDC and Justice Canada. A copy of the Office of the Privacy Commissioner of 
Canada's Privacy Statement is enclosed which explains how we handle your personal 
information. By filing a complaint with our Office, you agree to the Privacy Statement 
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if you do not consent to the amendment of your complaint to include Justice Canada 
as a respondent, please advise our Office in writing within 20 days of receiving this 
letter by sending a letter to the address below. Our Office wilt then continue to 
investigate your complaint with respect to HRSDConly. 



Once the investigation is concluded, you will receive a copy of a report detailing 
the findings of the investigation. 

Under subsection 33(2) of the Privacy Act, you have the right to make 
representations to the Privacy Commissioner before a finding is made in this matter. 
This means that you may, at any time prior to the completion of the investigation, provide 
to me any additional information or comments which you feel are relevant to your 
compfaint 

The Privacy Commissioner is mandated by Parliament to act as an ombudsman, 
advocate and guardian of privacy rights of Canadians. Our Office has a number of 
resources available on rts web site to help individuals protect their personal information, 
including a section specifically about Identity Theft. Please visit our web site at 
www.oriv.ac.ca for more information. 

Should you have any questions about this letter, please contact our Office in 
writing by quoting the above-noted file number, or at toll free 1-800-280-8755. 

Sincerely, 



v. 

Virginia Schwartz 

Senior Advisor, Investigations 

Office of the Privacy Commissioner of Canada 
112 Kent Street 
Ottawa ON K1A1H3 



Attachment 



Privacy Statement 



How do we handle your personal information? 

if you file a complaint, you provide the Office of the Privacy Commissioner of Canada with persona! information. 
The following questions and answers explain how we handle your personal information. 



Why is this information collected? 

The information you provide when you file a complaint to our Office is collected in order to allow us to process 
your complaint The information is collected under the authority of the Privacy Act 



How will this information be used? 

Any personal information we receive from you when you file a complaint is only provided to those members of 
our staff who require it in order to respond to your complaint. The information will be used to allow us to 
process your complaint and administer the Privacy Act. 

The information may also be used far the following purposes: 

• Statistical analyses for reporting and management purposes; 

• Reporting to Parliament (for example, the Privacy Commissioner submits annual reports to 
Parliament which may include select, anonymized case summaries of investigations); 

• Anonymized reports of investigative findings may be published on our website; 

• Conducting audits and identifying and addressing systemic privacy issues; 

• Quality control to ensure consistency in the investigative process; 
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• Research and litigation. 



Will personal information be disclosed? 

In accordance with section 64 of the Privacy Act, limited personal information may be shared with the 
organization that is the subject of the complaint (e.g. your name, nature of your allegations). 

The OPC does not otherwise disclose the information you provide unless such a disclosure is in accordance 
with the Privacy Act, which permits disclosure in limited situations. In the case of such a disclosure, the OPC 
will only disclose the information that is required and, wherever possible, will inform you. 
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Will I be able to access the information provided? And can I correct any 
errors? 

You have the right to request access to your personal information and also to request corrections if you befieve 
that your personal information is erroneous or incomplete. 



Where will the information be stored? 

The information will be stored in our Office's complaint processing system in the personal information bank 
number OPC PPU 005. A description of this and other banks of personal information held by federal 
government departments and agencies can be found in: Info Source, a public directory which is available online 
at www.infosource.qc.ca - 



How will the information be protected? 

The Office of the Privacy Commissioner of Canada is committed to protecting the privacy of individuals. All 
personal information provided when you file a complaint is protected under the Privacy Act. 

Because we cannot guarantee the security of electronic mail, we do not recommend sending sensitive personal 
information or complaints via e-mail. 

If you are concerned about the confidentiality of information, including your personal information, in transit, you 
should send it to us by secure means. You can do that by using our secure online complaintform or by sending 
your documents by mail. 



How long will the information be retained? 

Information provided in order to fiie a complaint about time delays under the Privacy Act is retained for two 
years after a file is completed (including any court action)..and then destroyed; information provided in order to 
file ail other types of complaints under the Privacy Act is retained for five years after a file is completed and 
then destroyed. 



Who can I contact if I have any questions? 

Questions about privacy issues may be directed to our Chief Privacy Officer, who is also the Director of our 
Access to Information and Privacy Unit You can contact the Chief Privacy Officer on our toll-free line at 
1-300-282-1376, or by postal maB at 

112 Kent Street 
Ottawa, Ontario 
K1A1H3 

Please visit our website for our online Privacy Statement and corporate Privacy Policy for our overall 
information management practices at www.oriv.Qc.ca . 



